CVEs published May 10, 2021
55 CVEs were published on May 10, 2021: 1 critical, 6 high. 2 are now in CISA KEV.
- Published
- 55
- Critical
- 1
- High
- 6
- Medium
- 13
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 2
- Fix available
- 5
Most affected products
- BIG-IP
- 5
- OpenClinic GA
- 4
- BIG-IP APM
- 2
- BIG-IP ASM/Advanced WAF
- 2
- IBM Cloud Pak for Security
- 2
- OpenAPITools openapi-generator · org.openapitools:openapi-g…
- 2
- ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base
- 1
- Dav-Git Dav-Cogs
- 1
- Delta Electronics CNCSoft ScreenEditor
- 1
- EC-CUBE CO. EC-CUBE · ec-cube/ec-cube
- 1
Critical 1
High 6
- CVE-2020-28600An out-of-bounds write vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2.Openscad
- CVE-2021-29502Remote code execution in the WarnSystem module of Laggrons-Dumb-Cogsretke Laggrons-Dumb-Cogs
- CVE-2021-29501Remote code execution in ticketerDav-Git Dav-Cogs
- CVE-2021-21822A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598.Foxit
- CVE-2021-28663The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading t
- CVE-2021-28664The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achie
Medium, low and unrated 48
- CVE-2020-23575A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus.
- CVE-2020-23369In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4
- CVE-2020-23370In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attac
- CVE-2020-23371Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remo
- CVE-2020-23373Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary w
- CVE-2020-23374Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitra
- CVE-2020-23376NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be inj
- CVE-2021-32489An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3.
- CVE-2021-32399net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
- CVE-2021-32053JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via historyca.uhn.hapi.fhir:hapi-fhir-jpaserver-base
- CVE-2021-21430Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala codeOpenAPITools openapi-generator · org.openapitools:openapi-g…
- CVE-2020-18102Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fi
- CVE-2020-27232An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3.OpenClinic GA
- CVE-2020-28588An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66.Linux Kernel
- CVE-2020-27226An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3.OpenClinic
- CVE-2020-27231A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application.OpenClinic GA
- CVE-2020-27230A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application.OpenClinic GA
- CVE-2020-27229A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application.OpenClinic GA
- CVE-2021-29022In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.
- CVE-2020-19199A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious u
- CVE-2021-20577IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting.IBM Cloud Pak for Security
- CVE-2021-20559IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting.IBM Control Desk
- CVE-2021-20538IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not IBM Cloud Pak for Security
- CVE-2020-13529An exploitable denial-of-service vulnerability exists in Systemd 245.Systemd
- CVE-2021-23016On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, aBIG-IP APM
- CVE-2021-23015On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance ModBIG-IP
- CVE-2021-23014On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization chBIG-IP ASM/Advanced WAF
- CVE-2021-23010On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when tBIG-IP ASM/Advanced WAF
- CVE-2021-23009On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a DeniaBIG-IP
- CVE-2021-23012On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation foBIG-IP
- CVE-2021-23013On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, tBIG-IP
- CVE-2021-23011On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x beforBIG-IP
- CVE-2021-23008On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BBIG-IP APM
- CVE-2021-32056Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on serve
- CVE-2021-25645An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1.
- CVE-2021-26583A potential security vulnerability was identified in HPE iLO Amplifier Pack.iLO Amplifier Pack
- CVE-2020-22809In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.
- CVE-2021-22672Delta Electronics' CNCSoft ScreenEditor in versions prior to v1.01.30 could allow the corruption of data, a denial-of-service condition, or Delta Electronics CNCSoft ScreenEditor
- CVE-2021-24011A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing tFortinet FortiNAC
- CVE-2021-31520A weak session token authentication bypass vulnerability in Trend Micro IM Security 1.6 and 1.6.5 could allow an remote attacker to guess cuTrend Micro IM Security
- CVE-2021-25849An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the Por
- CVE-2021-25846Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause
- CVE-2021-25845Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause
- CVE-2021-25847Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows inf
- CVE-2021-25848Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows inf
- CVE-2021-20717Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific iEC-CUBE CO. EC-CUBE · ec-cube/ec-cube
- CVE-2021-3003Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle
- CVE-2021-32471Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbit